templates/fargate-service.cfn.yml [299:373]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                  - $(aws ecr get-login --no-include-email)
              build:
                commands:
                  - docker build --tag $REPOSITORY_URI:$TAG .
              post_build:
                commands:
                  - docker push $REPOSITORY_URI:$TAG
                  - printf '[{"name":"${ServiceName}","imageUri":"%s"}]' $REPOSITORY_URI:$TAG > build.json
            artifacts:
              files: build.json
          - ServiceName: !Ref GitSourceRepo
      Environment:
        ComputeType: BUILD_GENERAL1_SMALL
        Type: LINUX_CONTAINER
        Image: !Ref CodeBuildDockerImage
        EnvironmentVariables:
          - Name: REPOSITORY_URI
            Value: !Sub ${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com/${EcrDockerRepository}
          - Name: ENVIRONMENT_NAME
            Value: !Ref EnvironmentName
          - Name: REPOSITORY_NAME
            Value: !Ref GitSourceRepo
          - Name: REPOSITORY_BRANCH
            Value: !Ref GitBranch
      Name: !Ref AWS::StackName
      ServiceRole: !Ref CodeBuildServiceRole
      VpcConfig:
        VpcId:
          Fn::ImportValue: !Sub ${NetworkStackName}-VpcID
        Subnets:
          - Fn::ImportValue: !Sub ${NetworkStackName}-PrivateSubnet1ID
          - Fn::ImportValue: !Sub ${NetworkStackName}-PrivateSubnet2ID
        SecurityGroupIds:
          - Fn::ImportValue: !Sub ${NetworkStackName}-AppSecurityGroupID

  CodePipelineServiceRole:
    Type: AWS::IAM::Role
    Properties:
      Path: /
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service: codepipeline.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: codepipeline-access
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Resource: "*"
                Effect: Allow
                Action:
                  - ecs:List*
                  - ecs:Describe*
                  - ecs:RegisterTaskDefinition
                  - ecs:UpdateService
                  - codebuild:StartBuild
                  - codebuild:BatchGetBuilds
                  - codecommit:GetBranch
                  - codecommit:GetCommit
                  - codecommit:UploadArchive
                  - codecommit:GetUploadArchiveStatus
                  - codecommit:CancelUploadArchive
                  - iam:PassRole
              - Resource: !Sub arn:aws:s3:::${CodePipelineArtifactBucket}/*
                Effect: Allow
                Action:
                  - s3:PutObject
                  - s3:GetObject
                  - s3:GetObjectVersion
                  - s3:GetBucketVersioning
    DependsOn:
      - CodePipelineArtifactBucket
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



templates/fargate.cfn.yml [319:393]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                  - $(aws ecr get-login --no-include-email)
              build:
                commands:
                  - docker build --tag $REPOSITORY_URI:$TAG .
              post_build:
                commands:
                  - docker push $REPOSITORY_URI:$TAG
                  - printf '[{"name":"${ServiceName}","imageUri":"%s"}]' $REPOSITORY_URI:$TAG > build.json
            artifacts:
              files: build.json
          - ServiceName: !Ref GitSourceRepo
      Environment:
        ComputeType: BUILD_GENERAL1_SMALL
        Type: LINUX_CONTAINER
        Image: !Ref CodeBuildDockerImage
        EnvironmentVariables:
          - Name: REPOSITORY_URI
            Value: !Sub ${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com/${EcrDockerRepository}
          - Name: ENVIRONMENT_NAME
            Value: !Ref EnvironmentName
          - Name: REPOSITORY_NAME
            Value: !Ref GitSourceRepo
          - Name: REPOSITORY_BRANCH
            Value: !Ref GitBranch
      Name: !Ref AWS::StackName
      ServiceRole: !Ref CodeBuildServiceRole
      VpcConfig:
        VpcId:
          Fn::ImportValue: !Sub ${NetworkStackName}-VpcID
        Subnets:
          - Fn::ImportValue: !Sub ${NetworkStackName}-PrivateSubnet1ID
          - Fn::ImportValue: !Sub ${NetworkStackName}-PrivateSubnet2ID
        SecurityGroupIds:
          - Fn::ImportValue: !Sub ${NetworkStackName}-AppSecurityGroupID

  CodePipelineServiceRole:
    Type: AWS::IAM::Role
    Properties:
      Path: /
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service: codepipeline.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: codepipeline-access
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Resource: "*"
                Effect: Allow
                Action:
                  - ecs:List*
                  - ecs:Describe*
                  - ecs:RegisterTaskDefinition
                  - ecs:UpdateService
                  - codebuild:StartBuild
                  - codebuild:BatchGetBuilds
                  - codecommit:GetBranch
                  - codecommit:GetCommit
                  - codecommit:UploadArchive
                  - codecommit:GetUploadArchiveStatus
                  - codecommit:CancelUploadArchive
                  - iam:PassRole
              - Resource: !Sub arn:aws:s3:::${CodePipelineArtifactBucket}/*
                Effect: Allow
                Action:
                  - s3:PutObject
                  - s3:GetObject
                  - s3:GetObjectVersion
                  - s3:GetBucketVersioning
    DependsOn:
      - CodePipelineArtifactBucket
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



